The dots do matter: how to scam a Gmail user

Re:The dots do matter: how to scam a Gmail user by shkkmo on Saturday April 07, 2018 @04:51PM (#16782884)

While you CAN strip periods in the local part of the email and convert them to lower case before checking uniqueness, you do this as the risk of improperly disallowing valid and distinct addresses. A better solution is to check for similar address and provide a prompt "do you already have an account with this address:" rather than completely blocking registration with that address.

However, you should definitely not do these things to the address that you save for the purposes of sending email because then you risk improperly sending emails to the wrong person.

In general, validating the format of an email address is both extremely hard and pointless (since only a small portion of mis-entries will results in an invalid email address).

Pretty much the only way to validate an email address effectively is to verify it by sending an email to it and expecting the user to click an email.

[ Parent | on HN ]

Re:The dots do matter: how to scam a Gmail user by djur on Saturday April 07, 2018 @05:21PM (#16783058)

To be clear, I'm talking about what email providers could do to reduce the risk of confusion, not what email senders should do to validate emails. I agree that the only way to validate an email address is to send a confirmation.

[ Parent | on HN ]

Re:The dots do matter: how to scam a Gmail user by shkkmo on Saturday April 07, 2018 @05:33PM (#16783124)

Except it does little to nothing to reduce confusion. It does nothing to fix the problem of people signing up using an email with a typo or with an email that doesn't actually belong to them.

This on service providers to implement secure access properly.

[ Parent | on HN ]

Re:The dots do matter: how to scam a Gmail user by djur on Saturday April 07, 2018 @05:43PM (#16783172)

I'm not thinking primarily of transactional emails here. If Gmail allowed dots and allowed registering both "jane.smith" and "janesmith", Jane Smith would be well-advised to register both, because it's going to be the most common mistake people make. It's the same principle that suggests that if you own a .org address you should probably go ahead and buy the .com, too.

[ Parent | on HN ]

Re:The dots do matter: how to scam a Gmail user by coredog64 on Saturday April 07, 2018 @05:26PM (#16783081)

Gmail is a fairly common mail host. Doing what you suggest for ‘@gmail.com’ addresses would be an easy solution.

You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely.

I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.

[ Parent | on HN ]

Re:The dots do matter: how to scam a Gmail user by shkkmo on Saturday April 07, 2018 @05:37PM (#16783146)

> You could also make the case that Google should have a free library for most common languages that does this for you. It would improve the safety of their users immensely.

Please don't. I don't want an official library to exist to facilitate people harvesting and selling my email address without me knowing the source of the leak.

> I may, however, be somewhat biased as I am the frequent recipient of email from weird services that some other chucklehead keeps signing up for even though he has yet to get past email verification as he doesn’t own the address.

And you have existing accounts with all of these services? Or how does this relate to service providers striping dots when checking uniqueness?

You should report those emails as spam. If you never verified the email address they have no right to continue to send emails to you.

[ Parent | on HN ]